Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/15195?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15195?format=api", "vulnerability_id": "VCID-hzq7-6765-myfp", "summary": "SMTP smuggling in Apache James\nApache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling.\n\nA lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to bypass SPF checks.\n\nThe patch implies enforcement of CRLF as a line delimiter as part of the DATA transaction.\n\nWe recommend James users to upgrade to non vulnerable versions.", "aliases": [ { "alias": "CVE-2023-51747" }, { "alias": "GHSA-p5q9-86w4-2xr5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/62696?format=api", "purl": "pkg:maven/org.apache.james/james-project@3.7.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-project@3.7.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/62697?format=api", "purl": "pkg:maven/org.apache.james/james-project@3.8.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-project@3.8.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/53716?format=api", "purl": "pkg:maven/org.apache.james/james-server@3.7.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.7.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/53731?format=api", "purl": "pkg:maven/org.apache.james/james-server@3.8.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.8.1" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/53729?format=api", "purl": "pkg:maven/org.apache.james/james-server@3.8.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6gfs-f46a-3qeb" }, { "vulnerability": "VCID-hzq7-6765-myfp" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.james/james-server@3.8.0" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-51747.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-51747.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-51747", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47434", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47503", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47484", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47506", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47514", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47563", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.4757", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47505", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47454", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47508", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47527", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47511", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47405", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47463", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47443", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47378", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47461", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00243", "scoring_system": "epss", "scoring_elements": "0.47513", "published_at": "2026-04-26T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-51747" }, { "reference_url": "https://github.com/apache/james-project", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/james-project" }, { "reference_url": "https://github.com/apache/james-project/commit/d1ef102540e504c067b6c1721a6f1e7eee9c6fc6", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/james-project/commit/d1ef102540e504c067b6c1721a6f1e7eee9c6fc6" }, { "reference_url": "https://github.com/apache/james-project/commit/d5cd8bb098aa78d8d62c9645f3c532689ef1cb03", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/james-project/commit/d5cd8bb098aa78d8d62c9645f3c532689ef1cb03" }, { "reference_url": "https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:37:43Z/" } ], "url": "https://lists.apache.org/thread/rxkwbkh9vgbl9rzx1fkllyk3krhgydko" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51747", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51747" }, { "reference_url": "https://postfix.org/smtp-smuggling.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:37:43Z/" } ], "url": "https://postfix.org/smtp-smuggling.html" }, { "reference_url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2024/02/27/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:37:43Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2024/02/27/4" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2267363", "reference_id": "2267363", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2267363" }, { "reference_url": "https://github.com/advisories/GHSA-p5q9-86w4-2xr5", "reference_id": "GHSA-p5q9-86w4-2xr5", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-p5q9-86w4-2xr5" }, { "reference_url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/", "reference_id": "smtp-smuggling-spoofing-e-mails-worldwide", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-03-15T20:37:43Z/" } ], "url": "https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/" } ], "weaknesses": [ { "cwe_id": 20, "name": "Improper Input Validation", "description": "The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly." }, { "cwe_id": 290, "name": "Authentication Bypass by Spoofing", "description": "This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": "7.0 - 8.9", "exploitability": "0.5", "weighted_severity": "8.0", "risk_score": 4.0, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hzq7-6765-myfp" }